code-foundry 1.48.7 → 1.50.0

package/.github/CONTRIBUTING.md

@@ -220,14 +220,14 @@ Keep pull requests focused and reviewable. Include screenshots or recordings for
 
 ## Workflow and check behavior
 
-| Event                                              | Expected automation                                                                   |
-| -------------------------------------------------- | ------------------------------------------------------------------------------------- |
-| Draft pull request targeting `main`                | No runner-heavy validation; run local checks before requesting review                 |
-| Ready pull request targeting `main`                | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate` |
-| Exact Release Please pull request targeting `main` | Full validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`  |
-| Scheduled or manual validation                     | Full audit tier                                                                       |
-| Push to a working branch                           | Draft PR workflow                                                                     |
-| Push to `main`                                     | Release workflow; CodeQL skips release-only merges (audit covers drift)               |
+| Event                                    | Expected automation                                                                                  |
+| ---------------------------------------- | ---------------------------------------------------------------------------------------------------- |
+| Draft pull request targeting `main`      | No runner-heavy validation; run local checks before requesting review                                |
+| Ready pull request targeting `main`      | Audit validation: CI, full tests, Security, and CodeQL, ending in `Validation / Gate`                |
+| Exact Release Please PR targeting `main` | Release diff, configured CodeQL, build/package check, and either a verified receipt or full CI/tests |
+| Scheduled or manual validation           | Full audit tier                                                                                      |
+| Push to a working branch                 | Draft PR workflow                                                                                    |
+| Push to `main`                           | Release workflow; CodeQL skips release-only merges (audit covers drift)                              |
 
 Draft pull requests do not start validation unless `draft_protection: false` is configured. The lightweight Draft Guard converts ordinary pull requests opened or reopened while ready back to draft; it never checks out pull-request code and it excludes Release Please version heads, whose release workflow owns their state. Marking a pull request ready for review starts the applicable validation tier, and each new commit on a ready pull request reruns that tier for the current head. Draft updates allocate no validation runner while protection is enabled. Converting a pull request to draft runs only the lightweight cancellation control.
 

package/.github/code-foundry.schema.json

@@ -7,6 +7,16 @@
       "description": "Explicit JavaScript formatter. Omit to preserve repository scripts and the Oxfmt fallback.",
       "type": "string",
       "enum": ["oxfmt", "prettier", "bun"]
+    },
+    "release_qualification_receipts": {
+      "description": "Opt in to seven-day exact-tree qualification receipts for Release Please validation.",
+      "type": "string",
+      "enum": ["true", "false"]
+    },
+    "npm_publish_auth": {
+      "description": "npm publisher authentication: auto preserves token users and uses OIDC when no publish token is present; oidc forces trusted publishing; token requires NPM_TOKEN.",
+      "type": "string",
+      "enum": ["auto", "oidc", "token"]
     }
   },
   "additionalProperties": true

package/.github/code-foundry.yml

@@ -5,6 +5,7 @@ languages: typescript
 features: all
 draft_protection: true
 codeql: auto
+release_qualification_receipts: false
 codeql_rust_shards: '["all"]'
 codeql_rust_threads: 1
 codeql_rust_max_parallel: 1
@@ -15,6 +16,7 @@ runtime_repository: 0xPlayerOne/code-foundry
 runtime_ref: v1.30.0
 release_type: node
 npm_publish: true
+npm_publish_auth: oidc
 license: agpl-3.0-or-later
 git_workflow: direct
 merge_strategy: squash

package/.github/workflows/ci.yml

@@ -23,6 +23,16 @@ on:
         required: false
         type: string
         default: task-result
+      release-build-only:
+        description: Run only the build lane after an exact successful source qualification receipt.
+        required: false
+        type: boolean
+        default: false
+      release-package-check:
+        description: Inspect the versioned npm package contents on release pull requests.
+        required: false
+        type: boolean
+        default: false
     secrets:
       TURBO_TOKEN:
         required: false
@@ -55,7 +65,7 @@ concurrency:
 jobs:
   format:
     name: Format
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.release-build-only != true
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -124,7 +134,7 @@ jobs:
 
   lint:
     name: Lint
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.release-build-only != true
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 30
     steps:
@@ -188,7 +198,7 @@ jobs:
 
   type-check:
     name: Type-Check
-    if: vars.CI_BILLING_PAUSED != 'true'
+    if: vars.CI_BILLING_PAUSED != 'true' && inputs.release-build-only != true
     permissions:
       contents: read
       issues: read
@@ -279,6 +289,7 @@ jobs:
           path: .github/.code-foundry
           sparse-checkout: |
             .github/actions
+            src/commands/qualification-receipt.mjs
             src/lib
             src/runtime-core.mjs
             src/runtime.mjs
@@ -287,6 +298,11 @@ jobs:
           mkdir -p .github/actions
           mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
           cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
+      - name: Set up Node.js 24.18.0 for package inspection
+        if: inputs.release-package-check == true
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
       - name: Detect
         id: applicability
         env:
@@ -296,8 +312,13 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
           BEFORE_SHA: ${{ github.event.before }}
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci should_run build >> "$GITHUB_OUTPUT"
+      - name: Verify versioned package build contract
+        if: inputs.release-package-check == true
+        env:
+          FOUNDRY_BUILD_TASK_APPLICABLE: ${{ steps.applicability.outputs.applicable }}
+        run: node "$RUNNER_TEMP/code-foundry/src/commands/qualification-receipt.mjs" package-contract
       - name: Setup
-        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        if: steps.applicability.outputs.applicable == 'true' && (inputs.release-build-only == true || steps.applicability.outputs.affected != 'false')
         uses: ./.github/actions/setup
         with:
           install: 'true'
@@ -305,8 +326,23 @@ jobs:
           task: build
       - name: Build
         id: execute
-        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.affected != 'false'
+        if: steps.applicability.outputs.applicable == 'true' && (inputs.release-build-only == true || steps.applicability.outputs.affected != 'false')
         run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" ci build
+      - name: Inspect versioned npm package contents
+        if: inputs.release-package-check == true && hashFiles('package.json') != ''
+        run: |
+          npm pack --dry-run --ignore-scripts --json > "$RUNNER_TEMP/foundry-package-inspection.json"
+          node --input-type=module -e '
+            import { readFileSync } from "node:fs";
+            import { join } from "node:path";
+            import { pathToFileURL } from "node:url";
+
+            const runtime = join(process.env.RUNNER_TEMP, "code-foundry", "src/lib/node-package-performance.mjs");
+            const { verifyNpmPackPackage } = await import(pathToFileURL(runtime).href);
+            const manifest = JSON.parse(readFileSync("package.json", "utf8"));
+            const report = JSON.parse(readFileSync(process.argv[1], "utf8"));
+            verifyNpmPackPackage(report, manifest);
+          ' "$RUNNER_TEMP/foundry-package-inspection.json"
       - name: Retain task receipt
         if: >-
           always() &&

package/.github/workflows/draft-enforcement_self-ci.yml

@@ -36,11 +36,11 @@ jobs:
             exit 1
           fi
 
-          read -r draft head_ref head_sha updated_at < <(
+          read -r draft head_ref head_sha updated_at node_id < <(
             gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" \
-              --jq '[.draft, .head.ref, .head.sha, .updated_at] | @tsv'
+              --jq '[.draft, .head.ref, .head.sha, .updated_at, .node_id] | @tsv'
           )
-          if [ -z "$draft" ] || [ -z "$head_ref" ] || [ -z "$head_sha" ] || [ -z "$updated_at" ]; then
+          if [ -z "$draft" ] || [ -z "$head_ref" ] || [ -z "$head_sha" ] || [ -z "$updated_at" ] || [ -z "$node_id" ]; then
             echo '::error title=Draft guard cannot verify current state::The GitHub API response did not include the required pull-request metadata.'
             exit 1
           fi
@@ -70,9 +70,13 @@ jobs:
             exit 1
           fi
 
-          gh api \
-            --method PATCH \
-            "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER" \
-            -F draft=true \
-            --silent >/dev/null
+          result=$(gh api graphql \
+            -f query='mutation($pullRequestId: ID!) { convertPullRequestToDraft(input: {pullRequestId: $pullRequestId}) { pullRequest { id isDraft } } }' \
+            -f pullRequestId="$node_id" \
+            --jq '.data.convertPullRequestToDraft.pullRequest | [.id, .isDraft] | @tsv')
+          read -r returned_id is_draft <<< "$result"
+          if [ "$returned_id" != "$node_id" ] || [ "$is_draft" != true ]; then
+            echo '::error title=Draft guard conversion failed::GraphQL did not confirm the expected pull request is a draft.'
+            exit 1
+          fi
           echo "Converted ordinary pull request #$PR_NUMBER to draft; validation waits for ready_for_review."

package/.github/workflows/qualification-receipt.yml

@@ -0,0 +1,201 @@
+name: Code Foundry Qualification Receipt
+
+on:
+  workflow_call:
+    inputs:
+      phase:
+        description: Produce evidence after a full audit or verify it for a release PR.
+        required: true
+        type: string
+      mode:
+        description: Validation tier associated with this receipt operation.
+        required: true
+        type: string
+      enabled:
+        description: Consumer opt-in for qualification receipt reuse.
+        required: false
+        type: boolean
+        default: false
+      codeql-enabled:
+        description: Whether the consumer requires CodeQL in its audit and release lanes.
+        required: false
+        type: boolean
+        default: true
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: true
+        type: string
+      runtime-ref:
+        description: Runtime commit, tag, or ref used by source validation.
+        required: true
+        type: string
+      job-results-json:
+        description: Normalized component results for the successful full audit.
+        required: false
+        type: string
+        default: '{}'
+      required-job-names-json:
+        description: Exact aggregate gate job names to verify from the source run's complete attempt-job listing.
+        required: false
+        type: string
+        default: '[]'
+    outputs:
+      reuse:
+        description: True only when a matching recent source receipt was verified.
+        value: ${{ jobs.verify.outputs.reuse }}
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+
+jobs:
+  verify:
+    name: Verify source receipt
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.enabled == true &&
+      inputs.phase == 'verify' && inputs.mode == 'release'
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    outputs:
+      reuse: ${{ steps.verify.outputs.reuse }}
+    steps:
+      - name: Checkout release PR source
+        id: source
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+      - name: Checkout runtime
+        id: runtime
+        if: steps.source.outcome == 'success'
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            src/commands/qualification-receipt.mjs
+            src/lib
+            src/runtime-core.mjs
+            src/runtime.mjs
+      - name: Install runtime
+        id: install
+        if: steps.runtime.outcome == 'success'
+        continue-on-error: true
+        run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+      - name: Set up Node.js 24.18.0
+        id: node
+        if: steps.install.outcome == 'success'
+        continue-on-error: true
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
+      - name: Check version-only release diff
+        id: release-policy
+        if: steps.node.outcome == 'success'
+        continue-on-error: true
+        env:
+          FOUNDRY_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          FOUNDRY_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          FOUNDRY_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          FOUNDRY_REPOSITORY: ${{ github.repository }}
+          RUNTIME_PATH: ${{ runner.temp }}/code-foundry
+        run: node "$RUNTIME_PATH/src/runtime.mjs" validation release_diff
+      - name: Verify source qualification receipt
+        id: verify
+        if: always()
+        continue-on-error: true
+        env:
+          SOURCE_READY: ${{ steps.source.outcome }}
+          RUNTIME_READY: ${{ steps.install.outcome }}
+          NODE_READY: ${{ steps.node.outcome }}
+          POLICY_READY: ${{ steps.release-policy.outcome }}
+          GITHUB_TOKEN: ${{ github.token }}
+          RUNTIME_PATH: ${{ runner.temp }}/code-foundry
+          RUNTIME_REPOSITORY: ${{ inputs.runtime-repository }}
+          FOUNDRY_MODE: ${{ inputs.mode }}
+          FOUNDRY_CODEQL_ENABLED: ${{ inputs.codeql-enabled }}
+          FOUNDRY_REQUIRED_JOB_NAMES_JSON: ${{ inputs.required-job-names-json }}
+        run: |
+          if [ "$SOURCE_READY" = success ] && [ "$RUNTIME_READY" = success ] && [ "$NODE_READY" = success ] && [ "$POLICY_READY" = success ] && [ -f "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" ]; then
+            node "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" verify >> "$GITHUB_OUTPUT"
+          else
+            echo 'reuse=false' >> "$GITHUB_OUTPUT"
+            echo 'reason=qualification or version-only release policy unavailable; using full validation' >> "$GITHUB_OUTPUT"
+          fi
+
+  produce:
+    name: Produce source receipt
+    if: >-
+      vars.CI_BILLING_PAUSED != 'true' && inputs.enabled == true &&
+      inputs.phase == 'produce' && inputs.mode == 'audit'
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    steps:
+      - name: Checkout tested source tree
+        id: source
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          ref: ${{ github.sha }}
+          fetch-depth: 2
+      - name: Checkout runtime
+        id: runtime
+        if: steps.source.outcome == 'success'
+        continue-on-error: true
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .github/.code-foundry
+          sparse-checkout: |
+            src/commands/qualification-receipt.mjs
+            src/lib
+      - name: Install runtime
+        id: install
+        if: steps.runtime.outcome == 'success'
+        continue-on-error: true
+        run: mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
+      - name: Set up Node.js 24.18.0
+        id: node
+        if: steps.install.outcome == 'success'
+        continue-on-error: true
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
+      - name: Create qualification receipt
+        id: produce
+        if: always()
+        continue-on-error: true
+        env:
+          SOURCE_READY: ${{ steps.source.outcome }}
+          RUNTIME_READY: ${{ steps.install.outcome }}
+          NODE_READY: ${{ steps.node.outcome }}
+          GITHUB_TOKEN: ${{ github.token }}
+          RUNTIME_PATH: ${{ runner.temp }}/code-foundry
+          RUNTIME_REPOSITORY: ${{ inputs.runtime-repository }}
+          FOUNDRY_MODE: ${{ inputs.mode }}
+          FOUNDRY_JOB_RESULTS_JSON: ${{ inputs.job-results-json }}
+          FOUNDRY_REQUIRED_JOB_NAMES_JSON: ${{ inputs.required-job-names-json }}
+        run: |
+          if [ "$SOURCE_READY" = success ] && [ "$RUNTIME_READY" = success ] && [ "$NODE_READY" = success ] && [ -f "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" ]; then
+            node "$RUNTIME_PATH/src/commands/qualification-receipt.mjs" produce >> "$GITHUB_OUTPUT"
+          else
+            echo 'reuse=false' >> "$GITHUB_OUTPUT"
+            echo 'reason=receipt setup unavailable' >> "$GITHUB_OUTPUT"
+          fi
+      - name: Upload qualification receipt
+        if: steps.produce.outputs.reuse == 'true'
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: code-foundry-qualification-v2-${{ github.run_id }}-${{ github.run_attempt }}
+          path: qualification-receipt.json
+          if-no-files-found: error
+          retention-days: 7

package/.github/workflows/qualified-foundry-publish.yml

@@ -16,9 +16,6 @@ on:
         required: false
         type: boolean
         default: false
-    secrets:
-      NPM_TOKEN:
-        required: false
 
 permissions:
   attestations: read
@@ -88,7 +85,6 @@ jobs:
       contents: read
       id-token: write
     env:
-      HAS_NPM_TOKEN: ${{ secrets.NPM_TOKEN != '' }}
       RELEASE_TAG: ${{ inputs.tag }}
       RELEASE_ASSET: ${{ inputs.asset }}
     steps:
@@ -98,16 +94,9 @@ jobs:
           persist-credentials: false
           ref: ${{ github.sha }}
       - name: Setup Node for trusted publishing
-        if: env.HAS_NPM_TOKEN != 'true'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version: '24'
-      - name: Setup Node for token publishing
-        if: env.HAS_NPM_TOKEN == 'true'
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '24'
-          registry-url: https://registry.npmjs.org
       - name: Retrieve only this run attempt's evidence
         env:
           GH_TOKEN: ${{ github.token }}
@@ -124,7 +113,6 @@ jobs:
       - name: Reverify and publish the tested tarball without lifecycle hooks
         env:
           GH_TOKEN: ${{ github.token }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
         run: |
           set -euo pipefail
           node src/commands/qualified-publication.mjs publish \